PT-2022-37330 · Pypi · Spam

Name of the Vulnerable Software and Affected Versions: spam affected versions not specified Description: The issue involves a compromise of a user account through a phishing attack, leading to the creation of a malicious release of the spam project on PyPI. This malicious release contains code th...

CVE-2022-32282

An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges...

notrinoserp 安全漏洞

notrinoserp is a web-based ERP by Phương Individual Developer, an accounting system written in PHP and MySql. A security vulnerability exists in versions prior to notrinoserp 0.7, which stems from not requiring users to use strong passwords. An attacker could exploit this vulnerability to...

MercadoLibre: Stored XSS in reclamos

Stored XSS vulnerability was discovered in the reclamos section of MercadoLibre. The issue was reported by @valent1ne, who provided clear steps to reproduce the vulnerability and a proof-of-concept code. MercadoLibre acknowledged the issue and implemented a fix...

Weak Password Requirements

Description The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts. Proof of Concept Steps to reproduce 1. Login to admin account. 2. Drom user account setup create a new user. 3. Full the form username user3 and...

CVE-2022-35280

IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634...

IBM Robotic Process Automation 安全漏洞

IBM Robotic Process Automation is a robotic process automation product from IBM USA. IBM Robotic Process Automation versions 21.0.0, 21.0.1 and 21.0.2 have a security vulnerability that stems from the fact that users are not required to have strong passwords by default, which can be exploited by...

Online Fire Reporting System SQL注入漏洞

Online Fire Reporting System is an online fire reporting system by Carlo Montero, an individual developer. A SQL injection vulnerability exists in version 1.0 of the Online Fire Reporting System due to a security issue with the date parameter in the node app, which can be exploited by an attacker...

Orange Station SQL注入漏洞

Orange Station is a garage management system by Mayuri K. Personal developer. It helps users to manage all vehicles, cars and motorcycles. Orange Station version 1.0 suffers from a SQL injection vulnerability that stems from a security issue with the username parameter, which can be exploited by ...

CVE-2021-24655 WP User Manager < 2.6.3 - Arbitrary User Password Reset to Account Compromise

The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password to an arbitrary value of any user knowing only their ID, and gain access to their account...

CVE-2022-30560

When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specified crafted packet to the vulnerable interface then lead the device to crash...

Dradis 竞争条件问题漏洞

Dradis is a suite of reporting and collaboration tools for information security teams. A competitive condition issue vulnerability exists in Dradis Professional Edition 4.3.0 and prior versions, which stems from a vulnerability that allows an attacker to change an account password via a password...

LinkedIn: The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more su

example- String username = request.getParameter"username"; String password = request.getParameter"password"; int authResult = authenticateUserusername, password; the security tokens can be bypassed easily , they are dont make user account safe . //script - check attached file Impact Technical...

Embedded Malicious Code in ctx

The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items when instantiating Ctx objects...

The vulnerability of the SCADA system “SKADA-NEV” is related to insufficient restrictions on authentication attempts, allowing a intruder to gain access to the user account.

The vulnerability of the SCADA system “SKADA-NEV” is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the user account by force...

Design/Logic Flaw

Dell PowerScale OneFS versions 8.2.0.x through 9.3.0.x, contain a weak password requirement vulnerability. An administrator may create an account with no password. A remote attacker may potentially exploit this leading to a user account compromise...

Malware in ctx

The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code that collected the content of os.environ.items when instantiating Ctx objects. The captured environment variables were sent as a base64 encoded query...

PYSEC-2022-199

The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items when instantiating Ctx objects...

GHSA-RV62-6F56-J83W Moodle Oauth 2 Insufficiently Protects Against Compromise

A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not verify users' email address changes require additional verification during sign-up to reduce the risk of account compromise...

HackerOne: Banned user still has access to their deleted account via HackerOne's API using their API key

The user's banned account could still be accessed using their previously generated API token, allowing them to perform actions such as retrieving reports, balance, earnings, payouts, weaknesses, and program information. This vulnerability was discovered and exploited on a test account...